MyBatis 3.6

Apply the Java 25 prompt first. These rules cover MyBatis core on Java 25, checked against MyBatis 3.6.0. Apply separately versioned integration and SQL generator prompts when those products are present.

SQL construction and scope

• Put untrusted values in #{...} parameters in mapper XML, annotated statements, and provider SQL. Keep statementType="PREPARED" for ordinary statements; it cannot repair SQL assembled with untrusted text before preparation.
• Never substitute a caller's value through ${...}. Choose identifiers, sort clauses, and other SQL structure from fixed application-owned branches, and bind all scalar values. Protect configuration properties used by ${...} as deployment inputs too.
• Keep @SelectProvider, @InsertProvider, @UpdateProvider, @DeleteProvider, and org.apache.ibatis.jdbc.SQL templates under developer control. Do not let a request supply a complete SQL statement or a builder fragment such as WHERE, ORDER_BY, or LIMIT(String).
• Keep <if test>, <when test>, and <bind value> expressions fixed in mapper code; OGNL executes expressions against parameters. Bind a derived <bind> value with #{...} when it enters SQL.
• Select mapper methods and SqlSession statement IDs in application code. Never allow request data to select a mapped statement, databaseId variant, result map, provider method, or stored procedure name.
• Bind the trusted tenant and owner scope into every applicable select, update, delete, count, aggregate, and nested query. MyBatis maps SQL but does not authorize rows. Put mandatory predicates